Installing SaMBa with OpenLDAP support - Revision history

82.161.20.132: /* OpenLDAP adaptation */

2009-08-23T16:55:15Z

OpenLDAP adaptation

← Older revision		Revision as of 16:55, 23 August 2009
Line 98:		Line 98:
	gunzip samba.schema.gz		gunzip samba.schema.gz
	cp samba.schema /etc/ldap/schema		cp samba.schema /etc/ldap/schema
	Next up, we include this schema into our LDAP configuration, by adding the following line to ''/etc/ldap/slapd.conf'':		Next up, we include this schema into our LDAP configuration, by adding the following line to ''/etc/ldap/slapd.conf'' under # Schema and objectClass definitions:
	include /etc/ldap/schema/samba.schema		include /etc/ldap/schema/samba.schema
	Not only do we need schema updates, we could also do with some more indices. Thus, we change the relevant section of ''/etc/ldap/slapd.conf'' to read:		Not only do we need schema updates, we could also do with some more indices. Thus, we change the relevant section of ''/etc/ldap/slapd.conf'' to read:

Insomnia: /* WINS configuration */

2009-08-23T15:09:39Z

WINS configuration

← Older revision		Revision as of 15:09, 23 August 2009
Line 90:		Line 90:

	Finally, we tell our DHCP server to provide clients with the IP address of our WINS server. We do this by adding the following line to ''/etc/dhcp3-server/dhcpd.conf'':		Finally, we tell our DHCP server to provide clients with the IP address of our WINS server. We do this by adding the following line to ''/etc/dhcp3-server/dhcpd.conf'':
	option netbios-name-servers 192.168.67.10		option netbios-name-servers 192.168.67.10;
	This line can either be added to the global section, or within the ''subnet'' declaration for each individual subnet that you want to inform of this WINS server.		This line can either be added to the global section, or within the ''subnet'' declaration for each individual subnet that you want to inform of this WINS server.

	=== OpenLDAP adaptation ===		=== OpenLDAP adaptation ===

Saruman!: /* Samba share configuration */ started

2008-11-22T17:22:04Z

Samba share configuration: started

← Older revision		Revision as of 17:22, 22 November 2008
Line 187:		Line 187:
	If we used a lowercase ''-w'', then we could have specified the password on the command line (''smbpasswd -w SuperSecret'').		If we used a lowercase ''-w'', then we could have specified the password on the command line (''smbpasswd -w SuperSecret'').

	= Samba share configuration		= Samba share configuration =
	With the above configuration, we should now be able to create a share, and make it available to our LDAP accounts. To this end, we create a directory that we're going to share, and give it a workable set of permissions. Suppose we have an LDAP user "jan" and an LDAP group "networkusers". We could then, as root, do this:		With the above configuration, we should now be able to create a share, and make it available to our LDAP accounts. To this end, we create a directory that we're going to share, and give it a workable set of permissions. Suppose we have an LDAP user "jan" and an LDAP group "networkusers". We could then, as root, do this:
	cd /data/samba		cd /data/samba
	mkdir Data		mkdir Data
	chown jan:networkusers Data		chown jan:networkusers Data
	chmod ~~1777~~ Data		chmod g+rwxs,o-rwx Data
	This ensures that user "jan", as well as every user that's a member of "networkusers", is allowed to read and write in this share. However, thanks to the "sticky bit" set with the ''chmod'' command, ~~all~~ files that are written to this directory ~~will get~~ "~~jan:~~networkusers" ~~as their owner~~.		This ensures that user "jan", as well as every user that's a member of "networkusers", is allowed to read and write in this share. However, thanks to the "sticky bit" set for the group with the ''chmod'' command, files that are written to this directory are automatically owned by the group "networkusers", who have read & write rights.

	Next step would be to share this directory, by adding the following section to ''smb.conf.master'':		Next step would be to share this directory, by adding the following section to ''smb.conf.master'':
Line 202:		Line 202:
	guest ok = no		guest ok = no
	read only = no		read only = no
	create mask = ~~0660~~		create mask = 0770
			create directory mask = 0770
			This makes the directory usable via the share "Data". Notice that we do not allow unauthenticated users ("guest ok = no"), that we allow writing in this share ("read only = no", although we could also have used "writeable = yes", which is the same), and that we mask every create operation (for both files and directories) so that they can set any right under "user" and "group", but cannot set any rights under "other". This prevents anyone other than the "networkusers" to read (let alone write) the files in this share.

Saruman!: /* Feed OpenLDAP with Samba information */ started with LAM input

2008-11-22T11:18:30Z

Feed OpenLDAP with Samba information: started with LAM input

@@ Line 111: / Line 111: @@
   sudo invoke-rc.d slapd start
 Check to see if the Samba objects are now usable in your LDAP server, e.g. by opening your LDAP Account Manager, and go to tools > schema browser; you should have objects like "sambaConfig" and "sambaDomain".
 == Samba configuration for LDAP authentication==

Saruman!: Started share config

2008-11-22T10:12:03Z

Started share config

← Older revision		Revision as of 10:12, 22 November 2008
Line 131:		Line 131:
	Retype new SMB password:		Retype new SMB password:
	If we used a lowercase ''-w'', then we could have specified the password on the command line (''smbpasswd -w SuperSecret'').		If we used a lowercase ''-w'', then we could have specified the password on the command line (''smbpasswd -w SuperSecret'').

			= Samba share configuration
			With the above configuration, we should now be able to create a share, and make it available to our LDAP accounts. To this end, we create a directory that we're going to share, and give it a workable set of permissions. Suppose we have an LDAP user "jan" and an LDAP group "networkusers". We could then, as root, do this:
			cd /data/samba
			mkdir Data
			chown jan:networkusers Data
			chmod 1777 Data
			This ensures that user "jan", as well as every user that's a member of "networkusers", is allowed to read and write in this share. However, thanks to the "sticky bit" set with the ''chmod'' command, all files that are written to this directory will get "jan:networkusers" as their owner.

			Next step would be to share this directory, by adding the following section to ''smb.conf.master'':
			[Data]
			comment = Data directory for us all
			browseable = yes
			path = /data/samba/Data
			guest ok = no
			read only = no
			create mask = 0660

Saruman!: /* Samba configuration for LDAP authentication */ added order note

2008-11-21T22:32:40Z

Samba configuration for LDAP authentication: added order note

← Older revision		Revision as of 22:32, 21 November 2008
Line 123:		Line 123:
	# allow user privileges		# allow user privileges
	enable privileges = yes		enable privileges = yes
			One note: if you use ''testparm -s'' to test and convert ''smb.conf.master'', then it's possible that your ''ldap suffix'' statement gets lower than one or more than the other ''ldap'' statements; you should rectify that before starting SaMBa, because otherwise SaMBa gets mighty confused, and cannot find the right LDAP OU's.

			Now the above declares the LDAP account ''admin,saruman,biz'' to be the LDAP admin account - but SaMBa hasn't got the admin password yet, so it can't do much. To this end, we let SaMBa store the password for this admin account in its own little secret file ''/etc/samba/secrets.tdb''. We do this by running
			smbpasswd -W
			Setting stored password for "cn=admin,dc=saruman,dc=biz" in secrets.tdb
			New SMB password:
			Retype new SMB password:
			If we used a lowercase ''-w'', then we could have specified the password on the command line (''smbpasswd -w SuperSecret'').

Saruman!: Started LDAP authentication

2008-11-21T22:11:49Z

Started LDAP authentication

@@ Line 5: / Line 5: @@
 === Software installation ===
-This is easy: using ''aptitude'', install the packages ''samba'', ''samba-tools'' and ''samba-doc'' - note that we NEED ''samba-doc'', as this package contains a configuration file that we need.
+This is easy: using ''aptitude'', install the following packages:
 As usual, Debian is asking us for the configuration details. For SaMBa 3.2, there are only two simple questions:
@@ Line 107: / Line 111: @@
   sudo invoke-rc.d slapd start
 Check to see if the Samba objects are now usable in your LDAP server, e.g. by opening your LDAP Account Manager, and go to tools > schema browser; you should have objects like "sambaConfig" and "sambaDomain".

Saruman!: /* OpenLDAP adaptation */ added extra indices

2008-11-21T18:44:34Z

OpenLDAP adaptation: added extra indices

← Older revision		Revision as of 18:44, 21 November 2008
Line 96:		Line 96:
	Next up, we include this schema into our LDAP configuration, by adding the following line to ''/etc/ldap/slapd.conf'':		Next up, we include this schema into our LDAP configuration, by adding the following line to ''/etc/ldap/slapd.conf'':
	include /etc/ldap/schema/samba.schema		include /etc/ldap/schema/samba.schema
	~~After this addition~~, we'll need to restart our LDAP server:		Not only do we need schema updates, we could also do with some more indices. Thus, we change the relevant section of ''/etc/ldap/slapd.conf'' to read:
	~~/etc/init~~.d/slapd ~~restart~~		# Indexing options for database #1
			index objectClass,uidNumber,gidNumber eq
			index cn,sn,uid,displayName pres,sub,eq
			index memberUid,mail,givenname eq,subinitial
			index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq
			Ofcourse, it's not just enough to add these parameters, we also need to generate the indices, and restart our LDAP server:
			sudo invoke-rc.d slapd stop
			sudo -u openldap slapindex
			sudo invoke-rc.d slapd start
	Check to see if the Samba objects are now usable in your LDAP server, e.g. by opening your LDAP Account Manager, and go to tools > schema browser; you should have objects like "sambaConfig" and "sambaDomain".		Check to see if the Samba objects are now usable in your LDAP server, e.g. by opening your LDAP Account Manager, and go to tools > schema browser; you should have objects like "sambaConfig" and "sambaDomain".

Saruman!: WINS added

2008-11-21T15:59:41Z

WINS added

@@ Line 9: / Line 9: @@
 As usual, Debian is asking us for the configuration details. For SaMBa 3.2, there are only two simple questions:
 * What do you want to be your Windows workgroup name? (we provide the name "AMBER")
-* Do you want to modify ''smb.conf'' to use WINS setting from DHCP? (we provide "yes")
+* Do you want to modify ''smb.conf'' to use WINS setting from DHCP? (we provide "no")
 === OpenLDAP adaptation ===
@@ Line 20: / Line 98: @@
 After this addition, we'll need to restart our LDAP server:
   /etc/init.d/slapd restart

Saruman!: put in schema change

2008-11-21T13:41:53Z

put in schema change

@@ Line 1: / Line 1: @@
-= The Samba Section=
+== The Samba Section==
 == Preparations ==
-First off, get yourself [http://oreilly.com/catalog/9780596007690/index.html this wonderful book] - and READ IT. Next, make sure our user backend of choice, OpenLDAP, is properly installed and can be used to authenticate users. If you haven't yet installed OpenLDAP, go to [[OpenLDAP | the relevant section]] of this wiki, and get going. Make sure
+First off, get yourself [http://oreilly.com/catalog/9780596007690/index.html this wonderful book] - and READ IT. Next, make sure our user backend of choice, OpenLDAP, is properly installed and can be used to authenticate users. If you haven't yet installed OpenLDAP, go to [[OpenLDAP | the relevant section]] of this wiki, and get going. Make sure your OpenLDAP is running well.